owasp-modsecurity / owasp-modsecurity/ModSecurity

Regular Expression Failure Triggers `!@rx`

Open
#3,123 6 comments 0 reactions 1 assignee View on GitHub

@airween is already working on this.

Since Apr 19, 2024.

3.x bug
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug

When there's a regular expression error due to SecPcreMatchLimit or SecPcreMatchLimitRecursion (i.e. MSC_PCRE_LIMITS_EXCEEDED), a rule using !@rx will say that the rule was triggered. However, failures with @rx will say that the rule was not triggered. I think both should assume the rule was not triggered. See https://github.com/coreruleset/coreruleset/issues/3640#issuecomment-2035841946 for additional context.

To Reproduce

See https://github.com/coreruleset/coreruleset/issues/3640#issuecomment-2037347642.

You can probably reproduce by setting SecPcreMatchLimit and SecPcreMatchLimitRecursion really low (maybe 5) and adding a !@rx rule.

Expected behavior

I would expect !@rx to not trigger a rule if there's a MSC_PCRE_LIMITS_EXCEEDED error.

Server (please complete the following information):

  • ModSecurity version (and connector): ModSecurity v3.0.12 with nginx-connector v1.0.3
  • WebServer: nginx-1.24.0
  • OS (and distro): Amazon Linux 2

Rule Set (please complete the following information):

  • Running any public or commercial rule set? CRS
  • What is the version number? 4.1.0

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.